I think two things get mixed up (not by you)... a lot of sites, especially American ones, only started showing any kind of notice/request for consent once GDPR

I think two things get mixed up (not by you)... a lot of sites, especially American ones, only started showing any kind of notice/request for consent once GDPR came in. But there was another wave before that, which everyone called the "cookie law" but which is apparently the ePrivacy Directive. A couple of interesting bits from https://www.privacypolicies.com/blog/eu-cookie-law/ https://www.privacypolicies.com/blog/eu-cookie-law/ "On the other hand, providing your customers with a customized user experience or tailored product suggestions is not a requirement for an online store, and cookies that enable these features do not fall under the "strictly necessary" category. You'll need to get consent before you use them." "Depending on your country's interpretation of the law, you may only need to get a user's "implied consent." Rather than forcing every user to click "accept" ... you can instead display a short message informing them that cookies are being used, typically through a header bar or some other non-obstructive method. After a predefined period of time ... the announcement can disappear." I think what happened is that a lot of sites went for non-compliance or implied consent until the GDPR came in requiring proper consent for most cookies and harsher penalties (?) and everyone went from 0 to 100. But people were complaining about & blocking even the implied consent banners when they first came in. Now everyone thinks the GDPR is about cookies but it's really about tracking.